Google has rolled out the November security update for Pixel phones as scheduled, and the items seen from the update list are fairly brief and seem to address some general bugs, including fixes for issues such as reduced power consumption, screen flickering, and occasional app crashes . In fact, this version of the update also fixes a very serious bug that allows others to bypass the lock screen of many Android phones in less than a minute without additional software and special tools.
The latest Android update is released, focusing on fixing a serious bug that bypasses the lock in one minute on some mobile phones
This way of bypassing the lock is done by David Schuetz What was found was surprisingly easy, requiring only direct access to the affected phone, and all that was needed was an additional SIM card with a locked PIN (and possibly an ejection pin). The entire operation process is so simple that it only needs to replace the additional SIM card in the target phone, enter the wrong PIN code for the SIM card 3 times, and finally enter the PUK code. By following these steps, the screen lock screen will disappear.
This content is currently unavailable due to your privacy preferences.
Please update the settings here to display the content.
David Schütz details the detailed reasons for this vulnerability in his blog. In short, the problem comes from the way Android implements screen locking, more precisely the narrow security screen that includes standard locking and PUK code input screens. category. When the security screen is about to be shown, like after booting or closing the screen and reopening it, Android stacks it on top and doesn’t allow the user to close it without passing a condition such as a valid fingerprint or password. When the conditions are met, the system will send a signal to close the top-stacked security screen and return to any remaining security screens, or to the application, home screen.
The unconventional issue that causes this vulnerability is caused by a system service that detects SIM card state changes. After accepting the PUK code and resetting the PIN on the SIM card, the SIM card will become active and system services will be interrupted by closing the PUK security screen and setting the general lock back to the top of the stack. However, when the operating system has finished processing the results of the PUK security screen, it still issues a message to close the security screen. With only one layer of security screen remaining (the regular lock screen), the system unexpectedly shuts it down and allows the user full access to the device.
There are a few caveats to this bypassed cheat method, the point being that it only fully works on devices that have been unlocked since the last boot. If not unlocked, the lock screen can still be bypassed, but private data and most settings cannot be accessed, often causing most software on the phone to malfunction until it is restarted.
This situation points to the need for regular, long-term security updates to phones that may still be in use. Of course, anyone with a potentially vulnerable phone should install the latest security updates as soon as they become available. At the same time, restarting your phone without unlocking it right away should prevent people from accessing your private data, and while not part of a routine strategy, it’s one of the most effective.